People under criminal investigation could lose the privilege against self-incrimination by being forced or tricked into giving access to encrypted messages under new powers contained in a government bill, the Australian Human Rights Commission has warned.

The AHRC and the Office of the Australian Information Commissioner have joined a growing number of organisations expressing concern about the Coalition bill to conduct covert surveillance on electronic devices and calling for better privacy safeguards.

The draft bill would give security agencies the ability to issue a “technical assistance notice” for a company to assist in decryption and the attorney general would gain a power to issue a “technical capability notice” requiring them to build a new capability to help interception and decryption.

The Australian Industry Group and the Communications Alliance, which represents tech giants Facebook, Google, Twitter and Amazon, have warned the legislation could create weaknesses in their products that open up users’ data to cyber-attack.

Although the bill says companies cannot be asked to build “a systemic weakness, or a systemic vulnerability” into their systems, the AHRC and information commissioner both warned those terms were ambiguous and required further definition. The AHRC said the fact the bill authorised “exceptional access measures” meant that caveat was not “fully effective” as a protection of privacy and “the draft bill could still be used to enable the creation of certain systemic weaknesses”.

The draft bill appears to permit the government to compel a provider to send users a notification to update software such as Facebook Messenger, “however, the downloaded software may not be an application update, but technology that allows a law enforcement agency to access the individual’s phone messages”, it said.

The AHRC noted that assistance orders could compel “a target or a target’s associate to provide the password, pin code, sequence or fingerprint necessary to unlock a phone”.

It warned the regime may “potentially impinge on the privilege against self-incrimination … if a suspect is ordered to provide information … that is only known to them — under threat of 10 years’ imprisonment for failure to comply”.

The AHRC recommended safeguards including limiting the access regime to the investigation of “serious crimes”, requiring decision-makers to consider the right to privacy, and requiring judicial oversight before notices were given.

Under the draft bill, where a warrant has been issued by a court to intercept telecommunications, technical assistance notices for a company to assist in decryption could be issued without further judicial oversight.

The information commissioner recommended that the government provide an exhaustive list of “acts or things” that companies and individuals could be required to do and to allow for prior technical analysis to ensure they “do not have any unintended effects on security systems”.

The commissioner also requested the new powers only be available for “more serious criminal and national security offences” and that a sunset clause should be provided for new powers, or at least a designated time for review.

The Communications Alliance submitted that the draft bill “bears the very real risk of severely damaging Australia’s cybersecurity”.

It accused the bill of creating “a schism between security and safety on the one hand and privacy rights on the other” and “friction between security/safety for the purpose of law enforcement and crime prevention, and security/safety of electronic products and services”.

The alliance suggested the lack of clarity on key terms raised concerns about the bill’s intent, implementation and “legislative overreach”.

“The extraordinarily broad application to almost any person or organisation that has dealings with electronic products and services, irrespective of their location, and the extremely wide scope of acts and things that can be requested of those actors further increase concerns of legislative overreach.”

It said the application of the law overseas was “unprecedented” and could put Australian providers in breach of foreign laws for complying with notices.

“The notice processes created under the draft bill are prone to the exercise of bias and lack an independent assessment mechanism,” it said, calling for “strong judicial oversight”.

Under the draft bill a “technical assistance notice” requires the company to give assistance where it is “reasonable, proportionate, practicable and technically feasible”, such as using an encryption key held by the company or giving access to devices or services.

In separate submissions, Telstra and Optus called for a consultation process, arguing that law enforcement agencies could not assess what is “reasonable, proportionate, practicable and technically feasible” without the input of communications providers.